GCSB-GDL-TRA-001 Training and Awareness Playbook

Document type: Guideline (advisory playbook) Parent procedure: GCSB-PRC-TRA-001 Training and Awareness Procedure Parent standard: GCSB-ST-CSF-TRA-001 Training and Awareness Standard, Version 2.0 Version: 1.0 Status: Issued Approved by: GCSB Governing Council, 19 October 2026 Effective: 19 October 2026 Next review: 19 October 2027 Prepared by: Global Converged Security Board (GCSB)

This playbook is advisory. It explains how to apply GCSB-PRC-TRA-001 in practice. Where this playbook and the parent standard or procedure differ, the standard and procedure prevail.

1. Purpose

The Training and Awareness standard requires that everyone in the organisation - and relevant third parties - has the security knowledge their role demands, converged across physical, cyber, personnel and information security. The parent procedure fixes the cycles, including induction training, annual refreshers and role-based training, within the 18-month extended track where applicable. This playbook shows how to build a programme that changes behaviour, with step-by-step guidance, worked examples, checklists and the records to keep.

The worked examples use the fictional Meridian Logistics Ltd (120 staff, head office, two warehouses, fleet operation).

2. Guiding principles

• Role-based, not one-size-fits-all. The receptionist, the developer, the guard and the director face different risks; train them differently.
• Behaviour is the metric. Completion rates measure attendance; simulated-attack results and incident reports measure learning.
• Converged content. People cause converged incidents (a tailgater who plugs in a found USB stick). Training must connect the domains.
• Little and often. Twelve ten-minute touches beat one annual two-hour lecture.

4. Scope and roles

This playbook applies to every organisation adopting GCSB-ST-CSF-TRA-001 through GCSB-PRC-TRA-001. It is advisory throughout: where it differs from the parent standard or procedure, the standard and procedure prevail.

5. Traceability

Play 1 - Analyse training needs (Procedure Steps 1-2)

Objective

Define what each role must know, mapped to the standard's requirements.

Step by step

1. List every role in the organisation, including third parties with access (contractors, cleaners, guards).
2. List the training topics the standard requires: induction, annual refresher, phishing resistance, physical security, data handling, incident reporting, role-specific duties.
3. Build the role-training matrix: roles down the side, topics across the top, required/optional in each cell.
4. Derive emphasis from the risk register and incident history: train hardest on what actually threatens you and what has actually gone wrong.
5. Approve the matrix at the committee; review it annually.

Worked example - Meridian Logistics

Meridian's matrix covers 8 internal roles plus 2 third-party roles (cleaners, agency drivers). Emphasis decisions from the risk register: warehouse staff get heavy tailgating and visitor-escort content; drivers get vehicle-security and cab-clear-out content; finance gets payment-fraud content; everyone gets the incident-reporting route. The matrix is approved at the May committee; the annual review date is set.

Checklist

• All roles listed, including third parties with access
• Topics mapped from the standard's requirements
• Role-training matrix approved
• Emphasis derived from risks and incidents
• Annual matrix review date set

Records to keep

• The role-training matrix (version-controlled)
• The committee approval minute
• The risk/incident inputs used for emphasis decisions

Common pitfalls

• Generic catalogue training. Off-the-shelf content that never mentions your real policies, your real reporting route or your real buildings teaches people to pass quizzes, not to behave safely.

Measures of success

Every person maps to a role and every role to a defined training set.

Play 2 - Build the programme (Procedure Steps 3-5)

Objective

Create the induction, refresher and role-based training the standard requires.

Step by step

1. Induction (recommended): build a short course covering acceptable use, the incident-reporting route, physical access rules and data-handling basics. Deliver before or on day one; nobody works a week untrained.
2. Annual refresher (recommended): short, updated each year with the year's real incidents (anonymised) and new threats. Last year's slides signal that security is stagnant.
3. Role-based: deeper modules for high-risk roles - privileged IT users, guards and reception, HR and finance (fraud targets), managers (approvals and exceptions), the governing body (their duties under the Governance standard).
4. Mix formats: short e-learning, toolbox talks, posters in the right places, and stories. People remember stories.
5. Record completion per person, per course, with dates.

Worked example - Meridian Logistics

Induction is 40 minutes on day one, delivered by the office manager with a checklist sign-off; agency drivers get a 15-minute version before their first shift. The first annual refresher (September) runs 25 minutes and uses two real Meridian near-misses: the reported phishing email and the propped-open fire door. Role-based modules: finance staff get a payment-fraud module with a callback-verification drill; warehouse supervisors get a tailgating-response module; the board gets a 45-minute session on its governance duties. Completion is tracked in a simple register: 118 of 120 complete by end-September; the 2 leavers are removed from the count.

Checklist

• Induction running for all joiners, before/at day one, recorded
• Annual refresher updated with the year's real events and delivered
• Role-based modules delivered to all high-risk roles
• Third-party version available and used
• Completion recorded per person per course

Records to keep

• Course materials with version dates
• Completion register (person, course, date, result)
• Induction sign-off checklists
• Update notes showing what changed each year

Common pitfalls

• Induction lag. Day-one access with month-three training is a self-inflicted exposure.
• Refresher rot. The same course three years running trains people to click through.

Measures of success

100% induction before access; refresher completion tracked to 100%; role-based coverage complete for high-risk roles.

Play 3 - Test awareness (Procedure Steps 6-8)

Objective

Verify that training changes behaviour, using simulations and measurement.

Step by step

1. Run phishing simulations regularly (monthly or quarterly), varying difficulty and theme.
2. Measure both click rate and report rate - the goal is an organisation that reports suspicious messages fast.
3. Test the physical side too: tailgating attempts, unattended-device checks, visitor-escort compliance. Converged testing is the CSF difference.
4. Adopt and honour a no-blame policy: coach and retrain, never punish; punishment drives failures underground.
5. Analyse trends by department and role; target follow-up training where results are weak.

Worked example - Meridian Logistics

Quarterly phishing simulations run from October. First run: 14% click, 9% report. After a toolbox talk on reporting, the January run: 9% click, 31% report - the report rate is celebrated, not the click rate punished. A physical test in November: an "actor" attempts tailgating at Warehouse North; challenged twice and let through once - the once becomes a coaching conversation and a reception-position adjustment, not a disciplinary. Trend analysis shows drivers report least; a cab-card with the reporting route is issued to every driver.

Checklist

• Phishing simulations on a regular cadence; click AND report rates tracked
• Physical security tests included
• No-blame policy stated and honoured
• Trends analysed; follow-up training targeted
• Results reported to the committee

Records to keep

• Simulation results per run (rates, not names)
• Physical test records and outcomes
• Follow-up training records
• Committee reports

Common pitfalls

• Gotcha culture. Publicly naming clickers destroys the reporting culture the programme exists to build.
• Click-rate obsession. A low click rate with a near-zero report rate still means incidents arrive unreported.

Measures of success

Report rates rise over time; repeat-failure rates fall; physical tests show improving compliance.

Play 4 - Sustain the culture (Procedure Steps 9-10)

Objective

Keep security awareness alive between formal training events.

Step by step

1. Run a monthly awareness rhythm: a short story, a near-miss shared (anonymised), a one-minute tip. Rotate domains so physical, cyber, personnel and information security all feature.
2. Use real internal incidents (sanitised) - nothing teaches like "this happened here".
3. Recognise good behaviour publicly: the person who reported the phish, the guard who challenged the tailgater.
4. Brief the governing body annually on programme results, in the same dashboard style as other CSF reporting.

Worked example - Meridian Logistics

Meridian's monthly touchpoint is a five-minute slot in each site's monthly briefing, rotating domains: January's is the fire-door near-miss (physical), February's is the misaddressed email (data), March's is a phishing example (cyber). Recognition: the warehouse operative who challenged the November tailgating actor is named in the briefing and given a voucher - cost GBP 25, effect on reporting culture immediate. The annual board briefing shows: 100% completion, report rate up from 9% to 34%, three physical tests passed.

Checklist

• Monthly awareness touchpoint running, domains rotating
• Real incidents used (sanitised) in content
• Recognition mechanism operating
• Annual report to the governing body

Records to keep

• The monthly touchpoint log (date, topic, domain)
• Recognition records
• The annual programme report

Common pitfalls

• Awareness fatigue. If people groan at security messages, the content is boring, not the audience. Shorten it, make it real.

Measures of success

Incident reporting volume rises (a good sign); staff can state the reporting route without looking it up.

Play 5 - Review, records and evidence (Procedure Steps 10-11)

Objective

Keep the programme current and the evidence complete.

Step by step

1. Review the programme annually against the standard: matrix currency, completion rates, simulation trends, incident correlations.
2. Consolidate training records into one register; records in five systems cannot evidence anything.
3. Handle training records as personal data per the Data Protection standard: access limited, retention defined.
4. Feed review findings into next year's matrix and content.

Worked example - Meridian Logistics

The February review finds: completion 100%, report rate rising, but role-based modules for the two new roles created in the restructure are missing - added to the matrix. The records consolidate into one register owned by the office manager; access limited to the office manager, HR and the CCSO; retention set to employment plus 6 years per the retention schedule. Two findings become next year's actions.

Checklist

• Annual programme review completed and minuted
• Training records consolidated into one register
• Records handled per the Data Protection standard
• Findings drive next year's programme

Records to keep

• The annual review report
• The consolidated training register
• Privacy handling notes for the register

Common pitfalls

• Records sprawl. Consolidate into one register.

Measures of success

The programme demonstrably improves year on year; records survive an audit.

4. Quick reference

5. Related documents

• GCSB-ST-CSF-TRA-001 Training and Awareness Standard, v2.0 (parent standard, sole normative source)
• GCSB-PRC-TRA-001 Training and Awareness Procedure (parent procedure)
• GCSB-ST-CSF-IRBC-001 (incident reporting) and GCSB-ST-CSF-DPP-001 (training records as personal data)

Version 1.0 - issued 19 October 2026. Copyright Global Converged Security Board.